Water Utility Cybersecurity for Western Washington

Since late July 2026, water and wastewater utilities in at least seven states have reported cyber intrusions — the FBI and EPA confirmed that attackers reached internet-exposed control systems, changed device passwords and IP addresses, and in some communities forced manual operations and boil-water advisories. No Washington system has been publicly named, but the Washington State Department of Health has warned hundreds of drinking-water providers, and the state's cybersecurity planning covers only the 249 largest suppliers. For most of Western Washington's small and mid-sized water districts, there is no state program coming. Securing your system is on you.

Spyderweb Communications has worked with water utility systems since 2003 — SCADA front-ends, PLC control networks, telemetry, backflow assembly management software, and meter-reading platforms like Badger and Sensus — and our team's water experience runs back to the late 1990s. This is not a service line we added when water systems hit the news. It is where we started: designing control networks that are fully segregated from business networks and the public internet, so an attacker scanning for exposed equipment never finds yours.

Our approach matches what federal guidance now urges every utility to adopt. Layer-3 firewalls between layer-2 broadcast domains keep control traffic completely separated from office traffic. Control systems get zero direct internet exposure. Access into the control environment is brokered, logged, and tightly restricted. And our 24/7 managed security operations watch the SCADA front-end around the clock, because a Tuesday-at-2-a.m. password change on a pump controller should never go unnoticed until Wednesday morning.

The July 2026 wave was not sophisticated, and that is the alarming part. Attackers found internet-facing PLCs — many with password protection never even enabled — locked operators out, and in some cases modified control logic. Officials widely believe the activity is linked to Iran, though no government has formally attributed it, and investigators are also weighing whether another state actor is imitating the 2023 CyberAv3ngers playbook. For a utility operator, attribution barely matters: the defense is identical either way.

The exposure is measurable. An EPA Office of Inspector General scan of 1,062 drinking water systems found 97 systems serving roughly 26.6 million people carrying critical or high-risk vulnerabilities. CISA's alert highlighted a subtler problem: undocumented cellular modems installed by operators, vendors, and integrators — connections that never appear on the network diagram and never get audited. Small systems were hit hardest, because small systems rarely have anyone whose job is to notice.

• Segmentation first. Layer-3 firewalls between layer-2 broadcast domains, so traffic between the office network, the SCADA front-end, and field controllers passes a checkpoint that permits only what the water system actually needs. No path from a billing PC or an email inbox to a pump controller. Zero direct internet exposure for any control device.
• Brokered, monitored access. When remote access is genuinely needed — and in a utility with staff on call, it usually is — it runs through a hardened gateway, every session logged and watched. No standing vendor tunnels, no forgotten cellular modems, no exceptions that outlive the service call that created them.
• Around-the-clock monitoring. SIEM-class monitoring on the control network's edge and endpoint protection on SCADA and HMI workstations, backed by our 24/7 managed security service. The 2026 intrusions announced themselves — password lockouts, controllers changing addresses, sites dropping offline. Monitoring is what turns those signals into a phone call instead of an outage.
• Know your exposure. A structured risk assessment maps every device, modem, and vendor connection into your control environment, and an external penetration test shows you exactly what an attacker sees from the outside. In our experience, the mapping always turns up at least one connection nobody remembered authorizing.
• Readiness for the bad day. The utilities that came through July 2026 best were the ones that could run manually and restore quickly. We build and rehearse that muscle with you — backup, recovery, and continuity planning scoped to how a water system actually operates.

We support water districts, PUDs, municipal water and wastewater systems, and the operators who keep them running — across Pierce, King, Thurston, and Kitsap counties and the whole Puget Sound region. From Tacoma and the state capital region, where regional wastewater infrastructure serves tens of thousands of connections, to 300-connection districts on well water, the systems out here match the size and profile of the utilities hit in July 2026 almost exactly.

If you operate a water system anywhere in Western Washington, you are in our service area. And if you are outside it, call anyway — we have yet to meet a water system we could not help, and utilities of every kind are part of the industries we serve.